►
From YouTube: Security at the speed of GitHub | GitHub InFocus
Description
Application security is still a challenge for every enterprise. GitHub takes a fundamentally different, community-driven approach to application security by natively integrating security into the developer workflow.
During this interactive roundtable, join Derek Chowaniec, Application Security Executive at GitHub, and Colin Dembovsky, Field Solutions Engineer at GitHub, to learn how GitHub Advanced Security drives greater risk reduction and scale without impeding velocity, allowing your teams to deploy fast—and safely.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
A
Excellent,
so,
as
we
start
to
go
through
this
presentation,
you
notice
that
there
is
a
chat
window,
so
we'd
love
to
hear
some
some
comments,
some
questions.
Of
course
you
know
if
you
have
a
question,
everyone
share
anything.
Please
raise
your
hand
and,
as
we
start
to
go
through
this
presentation
and
demonstration,
if
you
want
to
maybe
have
like
a
follow-up
demonstration
or
deeper
dive,
please
let
us
know
you
can
certainly
request
one
of
those
as
well.
A
So
before
we
start
getting
into
our
capabilities
right,
I
really
want
to
start
with
addressing
why
right,
why
has
has
github
chosen
to
offer
security
capabilities
in
the
first
place,
and
it
really
starts
with
what
you're
seeing
here.
So
one
of
the
things
that
we
did
was
over
well,
we
gathered
a
tremendous
amount
of
data.
A
Why
are
we
living
in
a
time
when
a
new
security
incident
is
being
reported
literally
every
single
day?
In
fact,
if
you
take
a
look
at
a
lot
of
the
breach
reports
for
some
of
these
security
incidents,
you'll
notice
that
an
alarming
number
of
these
are
as
a
result
of
application
layer
risk-
and
you
know
I'd
like
to
ask
that
question.
Why?
A
Because
to
be
quite
honest,
not
much
about
what
we
know,
but
code
security
is
new,
so
bear
with
me
right.
What
I
mean
by
that
is,
you
know:
we've
known
how
to
identify
and
remediate
the
most
common,
secure
coding
flaws
for
over
two
decades.
In
fact,
across
the
scripting,
was
first
coined
in
1999
by
engineers
at
microsoft,
so
we've
known
about
these
sorts
of
issues
now
for
again
two
decades.
Yet
you
know,
for
example,
crossroads
scripting
alone
is
still
one
of
the
most
pervasive
web
vulnerabilities
that
we
encounter.
A
A
So
you
know,
we've
had
all
this
information,
we've
had
all
the
tools
and
really
kind
of
what
well
we've
come
to
this
conclusion.
That
developers
are
the
key
right.
So
what
we
really
need
to
be
able
to
do
is
secure
the
whole
developer
workflow
to
help
solve
many
of
these
challenges,
and
with
that
said,
you
know,
I
think
that
we've
all
heard
about
shifting
security
left,
but
that's
also
not
new
either.
In
fact,
the
industry
as
a
whole
has
been
trying
to
kind
of
shift
security
left
for
at
least
a
decade.
A
A
A
A
I
think
that
the
majority
of
us,
when
we
hear
shifting
security
left,
I
think
in
the
back
of
our
minds-
or
rather
maybe
some
of
the
marketing
material
that
gets
shared.
What
they're
really
saying
is
yes
scan
early
skin,
often,
but
most
of
the
time,
the
definition
of
shifting
security
left
is
taking
some
some
security
tool
purpose
built
for
some
security,
professional
and
just
you
know,
sticking
it
in
an
ide
or
everywhere
that
a
developer
does
their
work.
But
in
reality
you
know
something
else
needs
to
change
needs
to
happen
by
changing
our
definition.
A
What
I
mean
by
that
is
you
see
a
lot
of
the
security
tools,
a
lot
of
security
information
when
it
was
developed.
It
was
actually
purpose
built
for
security
professionals
to
address
the
software
insurance
use
case.
A
lot
of
these
security
tools
were
never
developed
with
developers
in
mind.
They
certainly
weren't
developed
for
mediation
in
mind,
and
so.
A
A
That's
precisely
what
we're
doing
with
github
advanced
security.
So
what
we're
offering
with
advanced
security
is
a
developer
first
community-driven
approach
to
code
security
and
what
you're
seeing
here
is.
This
is
actually
our
product
strategy,
or
at
least
two
parts
of
it
we're
trying
to
build
security
for
developers
to
facilitate
greater
risk
reduction
and
greater
scale
and
we're
also
taking
this
community-driven
approach
and
what
I
mean
by
that
is
look
there's.
No
one
company
on
this
planet
that
has
access
to
infinite
development
resources
or
security
resources.
A
A
You
know
we're
we're
offering
some
some
natively
kind
of
built-in
security
testing
solutions
in
our
platform,
but
we
don't
expect
to
kind
of
do
everything
or
cover
every
single
analysis
technique.
There's
a
lot
of
there's
a
lot
of
businesses
that
are
leveraging
and
finding
value
in
many
other
security,
commercial,
available
security
tools
or
open
source
solutions.
A
Great,
so
what
is
covered
with
github
advanced
security,
or
rather,
what
are
we
focusing
on
we're
focusing
on
the
supply
chain?
That
is
our
our
software
composition,
analysis
solution.
So
with
with
with
github
advanced
security,
we
are
offering
dependency
reviews
we're
also
focusing
on
your
code.
So
we
have
a
code
scanning
a
static
analysis
solution
built
into
our
platform.
We
have
a
secret
scanning
solution
baked
in
as
well,
and
we
also
give
our
customers
the
ability
to
see
what
security
coverage
looks
like
across
an
entire
business
via
our
security
overview.
A
The
first
theme
is:
is
develop
developer
first,
tooling.
Really.
What
we're
saying
is
that
you
know
we
want
to
be
able
to
offer
and
develop
security
capabilities
that
are
going
to
meet
the
security
requirements
of
security
organizations,
but
are
built
with
developers
and
remediation
in
mind
from
the
beginning,
making
sure
that
we're
not
modifying
the
developers
workflow,
but
we're
actually
able
to
seamlessly
fit
inside
of
that
workflow
surface
information
that
makes
sense
to
developers
in
a
way
that
makes
sense
to
developers.
A
The
other
theme
is
is
having
all
this:
these
security
capabilities
and
information
just
native
offered
native
within
the
github,
the
github
platform,
one
of
the
the
biggest
kind
of
impediments
or
one
of
the
things
that
truly
impacts,
developer
productivity,
seven
to
constantly
context
switch
right.
In
fact,
the
average
enterprise
class
business
manages
roughly
things
around
about
150
different
tools,
developers
waste
a
tremendous
amount
of
time.
You
know
going
to
one
tool
for
quality
results,
another
tool
for
security,
information
and
and
kind
of
going
back
and
forth
reading.
B
A
We
think
about
automating
scanning
right
or
automating,
the
the
ability
to
export
results
from
some
security
tool
to
some
other
place,
and,
of
course,
you
know,
every
tool
should
be
able
to
do
those
things,
but
we're
thinking
about
automation
a
bit
differently
when
we
say
automation
that
makes
sense
we're
thinking
about
automation
that
facilitates
greater
risk
reduction
and
automation
that
facilitates
greater
scale
and
there's
a
great
example
of
this.
So
what
you're
seeing
here
is
an
example
of
that
it's
it's
an
advanced
security,
enforcer
action
and,
quite
simply
what
this
action
does.
A
B
All
right.
It
looks
like
it's
sharing
all
right.
So
thanks
thanks
everyone
for
joining
this
session.
My
name
is
colin
dembowski,
I'm
a
solution
engineer
here
at
github.
I've
joined
github,
probably
about
eight
months
ago,
but
have
been
in
the
devops
in
the
devops
industry,
at
the
devops,
consulting
for
about
10
or
12
years,
and
I
have
a
development
background
and
just
before
I
get
into
my
demo,
I
wanted
to
talk
a
little
bit
about
my
experience
in
security
from
a
developer
perspective,
and
this
has
been.
B
This
has
been
a
really
amazing
journey,
just
as
I
get
together
with
some
of
the
folks
like
derek
who
have
the
security
background
and
seeing
the
focus
on
developers
has
been
really
amazing
to
see,
and
so
my
first
job
I
did.
I
did
cnc
plus
development
and
we
used
to
put
print
lines
all
over
the
place
to
debug
and
and
so
I
would
have
to
put
entering
method
and-
and
then
I
would
have
counter
is
whatever
value
and
total
is
whatever
value
and
then
I'd
run.
B
The
application
and
I'd
look
on
the
console
and
I'd
see
what
what
was
happening
through
the
program
right-
and
I
remember
the
first
time
I
opened
up
visual
studio
in
my
second
job.
It
was
a
microsoft
shop
and
I
opened
up
visual
studio
and
I
realized
I
could
set
a
break
point
and
that
that
productivity
thinking
back
now,
I
I
didn't.
B
Now
we're
applying
that
the
same
that
same
quantum
leap
into
the
security
realm,
and
this
is
what
really
excites
me
about
github
advanced
security.
So
I
want
to
show
that
here
and
I
have
a
github
repo
app
here-
there's
some
java
code
in
this
github
repo.
This
is
not
really
a
coding
demo,
but
I
really
wanted
to
show
from
the
perspective
of
a
developer,
how
this
power
security
tooling
fits
seamlessly
into
that
developer.
Workflow.
B
So
I
don't
feel
like
it's
interrupting
my
flow
I
feel
like
I
can
be
a
much
more
efficient
developer
and
still
produce
secure
code,
so
this
application
happens
to
be
a
bit
of
java
code
that
we
deploy
into
azure.
Again,
it's
not
the
details
are
not
important
here,
but
it's
a
book
catalog
and
we
have
an
item
on
our
backlog
to
implement
a
search
feature.
So
I'm
going
to
jump
over
to
a
code
space
and
if
you've
been
seeing
some
of
the
keynotes.
B
My
my
colleague,
kevin
orwell,
showed
code
spaces
in
a
little
bit
more
detail,
but
I
have
some
code
that
I've
changed
here
right.
So
this
is
showing
a
diff.
That's
in
my
workspace.
Now
and
I've
added
my
five
or
ten
lines
of
code
here,
so
I've
made
some
change
here.
I'm
just
going
to
commit
that
change,
so
implement
book,
search
and
I'll,
commit
that
and
then
once
it's
committed,
I'm
going
to
publish
that
branch
to
my
repository
all
right.
Let's
just
do
this
quickly!
B
B
Advanced
security
features
within
this
repository,
and
this
is
very
significant
again,
even
if
you
have
one
of
our
competitor
tools,
you
have
a
problem
rolling
these
tools
out
at
scale.
Let's
say
you
have
some
kind
of
secret
scanning
tool.
Where
do
you
put
that
secret
scanning
tool?
If
you
put
it
with
the
developers,
they
may
forget
to
run
it.
B
This
is
a
maven
project
and
we're
pulling
in
a
whole
bunch
of
java
libraries
and
being
able
to
have
dependency
checking
where
we're
actually
looking
at
the
dependencies
and
and
automatically
notifying
when
there
is
a
vulnerability
to
be
able
to
turn
that
on
with
a
button.
Click
is
a
game
changer
and
because
it's
native
to
our
platform
we're
the
only
platform
that
can
do
this
right.
There's
no.
B
Tooling,
that
can
do
this
because
we're
the
only
security
tool-
that's
really
native
to
the
platform
that
developers
are
in
every
day,
so
once
I've
turned
that
on,
let
me
go
to
the
security
tab
and
I'll
click
on
depend
about
alerts.
So
this
is
our
dependency
scan
and
you'll
see
that
there
is
an
alert
here
and
if
I
open
that
up,
this
is
looking
in
my
palm
xml
file
right
and
we
support
most
major
package.
Language.
B
Systems
like
npm,
with
package.json
or
cs
proj,
for
for
nugets
and
so
on.
Right.
This
happens
to
be
a
palm
xml
for
maven
and
the
pandabot
has
found
that
we're
pulling
in
a
version
of
junit
and
our
version
is
between
4
7
and
4
13,
and
there
is
a
vulnerability
in
the
cve
databases,
and
here
is
the
the
information
about
that
vulnerability,
and
so
we
can
see
what
the
impact
is.
We
can
see
what
the
patches
are.
We
can
see
any
workarounds,
there's
a
whole
lot
of
information
here
again.
B
Not
just
can
we
make
a
developer
aware
of
an
issue,
but
can
we
help
a
developer,
fix
an
issue
and
understand
what
is
going
on
with
that
issue
so
that
they
become
better
developers
more
secure
developers
and
again,
because
this
is
right
in
the
context
of
my
repository,
it
feels
very
natural
to
me
as
a
developer.
So
I
can
see
the
patched
version
is
413.1
and
you'll
see
that
there's
actually
a
pull
request.
B
B
All
of
that
is
done
by
the
time
I
get
to
my
repository,
and
so
this
shows
just
how
much
more
effective
we
can
make
mitigating
vulnerable
dependencies
all
right.
So,
let's
go
over
to
the
code
space
see
if
that's
running
all
right.
Let
me
try
this
again.
I'm
going
to
implement
that
code
space.
I've
got
a
cheat
sheet
for
that
or
that
code
change.
B
So
let
me
see
if
I
can
get
this
to
work
and
it's
book
search,
that's
going
to
create
a
new
branch
for
me
and
I
actually
think
I
know
what
the
problem
is.
The
problem
is,
I
have
an
old
branch
here.
Let
me
just
delete
the
old
branch
that
I
had
again
give
me
one.
Second,
all
right
delete
that
branch
all
right,
so
I
should
be
able
to
push
that
change.
So
again,
I
have.
I
have
some
code
change
here
that
let
me
increase
the
font
size
a
little
bit
so
I
have.
B
I
have
some
code
that
I've
changed
again.
I'm
implementing
that
search
feature
and
I've
done
whatever
code
changes.
I
think
I
need
to
do
to
to
change
that
all
right.
So
let
us
commit
this
implement
book
search
this
time.
I'm
pretty
sure
I
will
be
able
to
push
this.
So
let
me
publish
that
branch
yeah
all
right,
so
I
I
forgot
to
sacrifice
a
chicken
to
the
demo
gods
this
morning.
A
B
Everything's
turned
out
well,
and
so
let's
push
that
branch
and
what
I
didn't
do
there,
which
I
should
have
is
created
a
pull
request
straight
from
my
code
space,
but
I
can
do
that
over
here.
I'm
going
to
hit,
compare
and
pull
requests
and
there's
again
implement
book
search
and
I'm
going
to
create
that
pull
request.
B
So
again,
this
is
just
my
daily
development
workflow,
I'm
changing
code,
I'm
implementing
code
from
the
backlog
or
implementing
tasks
from
the
backlog,
and
now
because
I've
created
that
pull
request,
we
have
automation
that
has
kicked
off
by
the.
By
that
event.
We
have
an
event
that
says
when,
when
someone
does
a
pull
request
into
main,
go
and
execute
these
automation,
automated
tasks
right,
this
is
using
actions
which
is
our
ci
cd.
A
B
And
you'll
see
one
of
them.
Is
this
code
scanning
action
all
right?
So
I'm
going
to
click
on
details,
so
you
can
see
it
in
real
time
and
this
this
is
a
yaml
file.
That's
inside
of
the
repository,
it's
a
very
simple
yaml
file
and
there's
really
a
couple
of
things
that
we
do.
We
initialize
the
code
scanning
and
that's
going
to
create
an
empty
database
for
us
and
it's
going
to
hook
into
our
build
process.
B
Now
we
do
have
an
auto
build,
that's
going
to
do
a
build,
a
best
effort
build,
but
if
you
have
custom
build
steps,
you
would
just
put
them
in
here,
and
these
are
whatever
build
steps
you
need
to
to
execute
in
order
to
build
your
application
and
once
we've
once
we've
done,
that
that
creates
that
populates
the
database.
So
while
we're
building
this
database
that
I
spoke
about
is
being
populated
with
a
graph
of
our
code
and
again
code
qr
understands
how
our
code
works.
B
It
has
semantic
knowledge,
it
has
data
flow
knowledge,
so
it
knows
how
data
flows
through
our
application,
and
so
once
we've
completed
our
compilation.
We
can
then
execute
a
suite
of
queries,
and
this
is
where
code
ql
comes
from
code.
Ql
stands
for
code,
query
language,
it's
kind
of
like
t
sql,
and
the
the
great
thing
about
this
is
that
you
can
create
your
own
custom
code.
B
All
of
these
queries
are
being
executed
and
you
can
see
there's
a
summary
at
the
end
here:
we've
analyzed
441
lines
of
source
code.
So
again,
a
little
bit
of
a
sanity
check
there
to
make
sure
that
we're
scanning
what
we,
what
we
think
we're
scanning
and
that's
just
to
show
you
a
little
bit
what
happens
under
the
hood.
But
what
does
this
mean
for
me
as
the
developer
right?
So
I've
had
my
pull
request.
Some
action
has
queued
off
now.
B
If
I
look
go
back
to
that
pull
request,
I
can
see
there's
this
little
red
x.
Next
to
my
pull
request,
that's
probably
a
bad
sign,
so
I'm
going
to
click
on
that
implement
book
search
and
I'm
going
to
go
and
look
at
this
pull
request
and
I'm
going
to
take
off
my
developer
hat
and
put
on
my
code.
Reviewer
hat
and
I
can
see
the
code
coverage
here,
because
our
action
posts
back
the
code
coverage
results
here.
But
what
I'm
really
interested
in
is.
B
I
have
a
list
of
checks
here,
and
most
of
them
are
green,
except
for
this
code
scanning
one,
which
is
where
that
red
x
comes
from.
So
there's
some
kind
of
check-
that's
failing
here,
so
I
can
click
on
details
and
that'll.
Take
me
back
to
that
action
that
I
just
showed
you
so
I
can
see
in
line
what
what
what
action
failed
or
which
step
in
that
workflow
failed.
But
I
can
also
see
that
if
I
go
files
changed,
I'm
going
to
see
inline
in
my
pull
request.
B
These
are
the
lines
of
code
that
I
changed
and
I
pushed
on
this
branch-
and
I
can
see
here
that
I
have
unchanged
files
with
check
annotation.
So
there's
some
kind
of
annotation
and
here
is
where
we
see
this
red
x.
So
this
red
x
is
detecting
that
on
this
line
of
code
on
line
120
in
book
database
implementation.java,
we
have
a
code
scanning
alert
and
it
says
query
built
from
user
controlled
sources.
B
So
I'm
going
to
click
on
show
paths,
and
this
is
a
java
servlet.
So
when,
when
that
book,
application
comes
up
on
the
on
the
browser-
and
I
fill
in
the
title
that
I'm
searching
for
and
I
click
the
submit
button.
This
is
the
entry
point
in
my
code
that
is
then
going
to
parse
the
http
request
and
extract.
This
parameter
called
title
from
the
from
the
post
to
my
to
my
servlet
and
then
once
we've
parsed,
that
we're
passing
it
into
the
search
books,
method
and
then
that's
defined
in
bookservice.java.
B
So
here's
that
search
books
method,
which
is
then
going
to
call
our
books
database
implementation,
get
books
by
title
and
here's
that
file
and
again
there's
the
method
where
it's
coming
in
and
here's
finally,
where
it
ends
in
the
sync.
So
codeql
has
shown
us
where
the
vulnerability
is
as
well
as
showing
us
how
the
data
flow
through
our
code
works.
B
So
we
can
understand
where
the
sources
and
where
the
sinks
and
what's
the
entire
data
flow
through
here
now
in
this
case,
there's
only
a
single
path
to
this,
but
you
could
conceive
of
some
back-end
methods
where
there's
a
vulnerability
deep
down
in
your
stack
somewhere.
That
has
multiple
entry
points
and
so
again
code
ql
will
surface
all
of
those
different
parts.
We
can
understand
how
that
code
has
flowed
to
the
point
where
there's
a
vulnerability,
all
right
so.
B
More
at
what
this
vulnerability
actually
is
right,
so
I'm
going
to
click
on,
show
more
details
here
and
that's
going
to
take
me
to
this
to
the
alert
right,
so
we're
back
in
the
security
tab
and
again
I
could
click
show
pause
to
see
all
the
parts
here,
but
we
see
this
is
a
java,
sql
injection
rule
and
here's
the
the
short
description
and
again
I
can
click
show
more
and
I
get
now.
I
get
very
detailed
information
about
what
this
vulnerability
is.
B
What
the
recommendation
is,
I
get
to
see
some
examples:
here's
some
bad
code,
here's
how
it
I
would
make
that
good
code
there's
another
example:
some
more
explanations
to
it:
some
more
good
code,
bad
code,
some
references
down
here,
showing
cve
links,
and
so
again
this
is
not
just
about.
Can
we
find
a
vulnerability,
but
can
we
focus
the
developer
on?
This
is
a
real
vulnerability,
so
codeql
has
an
incredibly
low,
false
positive
rate.
B
So
we're
not
inundated
with
noise
that
we
don't
that
we're
just
going
to
dismiss
right,
we're
actually
getting
alerts
that
are
meaningful
and
then
once
we've
opened
up
that
alert
we're
providing
the
help
that
a
developer
needs
to
actually
mitigate
this.
So
we're
we're
reducing
that
mean
time
to
remediate
once
we've
actually
discovered
those
vulnerabilities
and
so
again
the
developer
can
go
here
and
the
reviewer
could
fail
this
review.
B
The
developer
could
open
up
the
same
the
same
set
of
files
and
security
alerts,
and
they
could
see
what
this
issue
is
and
they
could
go
ahead
and
fix.
Now.
I
want
to
show
one
more
thing,
so
this
this
is
coming
from
our
native
code
scanning
codeql
tool,
which
is
our
static
analysis,
query,
a
static
analysis,
scanning
tool
or
sas
tool,
but
the
way
we
operate
our
sas
tool
under
the
hood
is
we
use
a
serif
format.
So
serif
is
a
is
a
json
format.
B
That's
standard
in
the
in
the
security
industry
around
it
stands
for
static
analysis,
results,
interject
format.
So
it's
a
json
file
that
lets
you
encapsulate
scanning
results
in
a
standardized
way
and
if
I
clicked
on
tool
here,
you'll
see
that
I
do
have
code
ql
here.
It's
showing
zero
because
it's
actually
on
a
pr,
not
not
in
one
of
my
not
in
the
main
branch.
So
it's
filtered
that
out,
but
you
can
see
that
I
have
gripe
and
ancor
and
trivi.
B
So
this
is
a
good
example
where
we're
allowing
the
community
to
use
other
tools
that
produce
sarah
formats
like
encore
and
trivia,
which
are
container
scanning
solutions
and
because
we're
allowing
them
to
upload
their
serif
files.
They're
we're
able
to
integrate
with
other
security,
tooling
and
again,
derek
spoke
about
us,
not
just
giving
another
tool
to
developers
but
really
creating
a
platform
that
can
be.
That
can
be
this.
This
single
pane
of
glass
really
for
for
security
and
and
it's
right
again
built
into
the
very
platform
that
developers
are
busy
with
every
day
right.
B
A
I
can
call
them
real
quick,
you
know
when
we
also
say
you
know
other
tools,
you
know
it's
not
just
like.
You
know
commercially
available
solutions
that
you
might
have
been
using.
You
know
for
a
while
right.
Well,
it's
really
anything
that
can
export
results
in
serif
format,
and
so
you
know,
I've
met
a
lot
of
security
professionals
that
are
huge
fans
of
open
source
tools
and
solutions
as
well.
Those
can
be
integrated,
in
fact,
we
already
have
integrations
for
many
of
those
in
the
marketplace
already.
A
Things
like
like,
like
another
static
analysis
tool
or
something
else
for
checking
your
dependencies.
You
know
you
could
have
a
container
scanning
solution
that
you're
in
love
with,
or
you
know,
let's
say,
you're
using
a
tool
like
now
secure
for
mobile
security
testing
right.
All
of
those
simply
be
added,
so
that
again,
your
developers
are
seeing
everything
in
one
place,
but
they're,
seeing
a
way
that
makes
sense
right.
B
We
don't
have
to
write
a
whole
bunch
of
code
to
go
and
analyze
do
we
have
failures
here
before
we
merge
in
we've
built
that
into
the
platform.
So
it's
very
easy
to
integrate
that
in
right,
so
we
we've
covered
dependency
scanning
with
depender
bot.
So
that's
scanning
all
my
dependencies
that
I'm
pulling
in
I've
just
showed
you
very
quickly
what
it
looks
like
to
scan
the
code
that
you
yourself
are
writing
or
your
teams
are
writing
the
third
functional
area
that
we
have
in
github.
Advanced
security
is
secret
scanning
right.
B
So
you'll
see
that
here
we
have
a
secret
scanning
section
where
we
can
define
custom
patterns.
Now
we
have
partnered
with
major
sas
providers
like
aws
and
gcp
and
azure,
and
really
a
whole
list
of
of
partners
that
we've
worked
with
where
they've
said.
This
is
the
pattern
for
our
tokens
that
we
that
we
issue,
and
so
we've
integrated
from
our
partners,
these
patterns
into
our
into
our
scanning
into
our
secret
scanning
tool.
You
can
also,
though,
define
custom
patterns.
B
So
let's
say
that
you
were
issuing
tokens
for
your
apis
and
you
had
some
kind
of
hash
format
that
you
were
using.
You
could
put
this
in
here
to
make
sure
that
your
developers
are
not
checking
any
any
secrets
in
that
match
that
token
format
now
you'll
also
see
this
push
protection
here
and
again.
Kevin
olwell
did
a
great
demo
of
this
in
the
keynote
yesterday.
But
what
this
is
the
the
secret
scanning
is
post
commit,
so
I've
already
done
my
commit
and
then
our
secret
scanning
is
going
to
go
and
check
the
check.
B
A
B
But
we
want
to
prevent
once
we've
turned
it
on.
We
want
to
actually
prevent
new
secrets
from
getting
into
the
repository
at
all,
and
so
this
push
protection.
What
this
does
is
it
executes
the
same
secret
scanning
logic
on
the
push
and
will
actually
fail
the
push
if
it
detects
a
secret
and
so
that
the
the
secret
doesn't
even
get
into
the
repository
in
the
first
place,
and
so
that's
something
you
can
enable
or
disable
according
to
according
to
your
policies,
but
really
love.
This
feature
that
this
is.
B
This
is
getting
to
the
point
where,
where
the
the
platform
is
actually
even
preventing
the
commit
with
a
secret
from
even
getting
into
the
repository
in
the
first
place,
and
then
I
wanted
to
show,
I'm
gonna
go
up
to
the
organization
level,
so
I've
been
working
in
the
repository
and
that's
really
the
the
hub
of
the
security
tooling
is
really
at
the
repository
level,
which
works
fine.
For
me
as
a
developer,
it
works
fine
for
a
scrum
team,
but
what?
B
If
you're
in
the
compliance
and
security
or
infosec
team
and
you're
managing
hundreds
of
developers
or
thousands
of
developers?
How
do
you,
how
do
you
see
what
your
risk
posture
is
at
scale,
and
this
is
where,
if
I
go
to
the
security
tab
at
the
organization
level,
I
get
the
security
overview
where
I
can
see
an
aggregation
over
all
the
repositories
that
are
in
this
particular
organization.
B
I
can
see
which
repo's
have
those
features
enabled
or
not
enabled,
and
if
I
show
more,
I
get
a
little
bit
more
detail
on
code
scanning,
dependable
and
secret
scanning
alerts
and
again
which
repos
or
how
many
of
our
repos
have
it
enabled
or
don't
have
it
enabled
and
then
down
here
I
get
to
actually
see
that
roll
up
per
repository
and
so
again
as
a
as
a
infosec
professional
working
in
this
organization.
I
have
this
single
place
where
I
can
go
and
manage
risk
at
scale
across
the
enterprise.
B
B
Yeah,
so
I'm
going
to
answer
that
question
at
two
levels,
so
about
the
tactical
level.
I've
gone
up
again
to
my
organization
level
to
the
code
and
security
analysis
section
of
my
settings.
So
this
is
at
my
organization
level
and
you
can
see
I
can
turn
on
dependency
graph,
dependable
alerts,
github
advanced
security
secret
scanning.
This
is
that
and
I'm
going
to
borrow
your
phrase
because
I
love
this
so
much
it's
instant
on
and
again
I
alluded
to
this
a
little
bit.
So
let's
say
that
you
want
secret
scanning
across
your
organization
again.
B
B
We
don't
have
to
go
and
educate
teams
and
go
team
by
team
a
little
bit
more
work
to
do,
arguably
for
codeql,
where,
where
there's
a
compiled
language
involved
mostly
around
because
it
hooks
into
builds
right,
so
those
builds
tend
to
be
very
custom,
very
application
or
team
specific.
But
as
far
as
dependent
bot
and
dependency
scanning
and
secret
scanning,
these
are
instant
on
and
so
again.
This
is.
B
Again
what
I've
showed
you
here
is
the
administrators
and
the
infosec
professionals
they
come
and
they
enable
these
these
these
settings
they
can
enable
policies
they
can
ensure
that
these
policies
are
enabled
at
the
repository
level
and
then
they're
freed
up
like
just
like
I,
as
a
developer.
I'm
freed
up
to
do
feature
work
when
I'm
not
doing
my
builds
manually
in
the
same
way:
github
advanced
security,
the
platform
and
the
features
that
we
have
frees
up
your
security
team.
B
Instead
of
spending
their
time,
nursing
the
tools
or
nursing
some
server
somewhere,
that's
going
to
perform
all
your
scans
and
and
and
categorizing
your
applications,
for
which
ones
are
we
going
to
scan
or
not
scan
because
it's
so
expensive
to
scan
and
instead
of
doing
all
of
that
sort
of
operational,
really
non-value.
Add
we're
now
freeing
up
your
security
professionals
and
your
security
teams
to
work
with
your
developers
to
to
bring
that
security
culture
into
your
developers
and
that's
real
value
ad.
That's
real!
B
That's
real
value-add
for
the
business,
helping
the
security
professionals
do
what
really
matters
to
the
business
right.
Instead
of
nursing
all
these
different
tools
and
trying
to
extract
large
pdf
dumps
so
that
they
can
get
it
to
the
developers
and
the
developers
have
already
moved
on
so
they're
not
going
to
fix
it
and
having
all
those
kind
of
you
know,
I'll,
throw
it
over
the
wall
to
security
and
security
is
just
going
to
block
me
and
you
know
we're
facilitating
a
cultural
change
and
a
cultural
shift
where
we're
we're
helping
security
develop.
B
A
B
Yeah
so
I'll
answer
the
the
secret
scanning
one
first,
I
kind
of
did
touch
on
that
a
little
bit
how
we
have
push
protection,
which
runs
our
secret
detection,
our
secret
scanning
logic,
to
detect
secrets
before
the
push
actually
succeeds
right.
So
when,
if
you
go
to
your
console
and
you
type
get
push
and
we
detect
a
secret,
we'll
fail
the
push
just
like
you
saw
my
failure
earlier
on,
because
I
was
trying
to
push
to
a
branch
that
was
out
of
date
same
kind
of
experience.
B
A
A
You
know,
maybe
you
can
talk
a
little
bit
about
how
we're
able
to
kind
of
export
some
of
this
data
right
to
other
places
right,
whether
it's
a
another
security
tool,
whether
it's
like
a
reporting
or
dashboarding
sort
of
solution,
or
even
like
a
grc
tool.
Can
you
maybe
talk
a
little
bit
about
how
we're
able
to
take
all
this
valuable
information
and
just
use
it
in
other
ways,
yeah.
B
Great
question
so
in
the
security
tab,
I
showed
you
where,
when
we
have
a
dependency
alert,
we
create
this
alert
here
in
in
the
security
tab.
For
that
repository
same
for
code
scanning
and
secret
scanning
again,
because
github
is
because
we're
building
onto
this
github
platform,
which
is
very
rich
in
terms
of
notifications
and
web
hooks,
and-
and
we
have
this
very
rich
eventing
system.
These
are
just
events
that
that
a
come
out
in
our
audit
log.
B
So
you
can,
you
can
monitor
the
audit
log
and,
as
new
vulnerabilities
are
found,
they
will
come
up
in
the
audit
log.
So
if
you're,
if
you're
streaming,
our
audit
logs
to
splunk,
for
example,
splunk-
has
a
github
application
in
the
splunk
marketplace.
That
will
put
some
dashboards
up
and
there
are
some
github
advanced
security
dashboards.
That
look
specifically
at
things
like
meantime
to
remediate,
because
we
know
when
the
alert
was
opened
and
when
that
is
remediated,
we
know
when
it
was,
it
was
closed
or
remediated,
and
so
we
can
actually
start
helping
visualize.
B
A
Another
question
that
gets
brought
up
pretty
frequently
is:
you
know,
obviously
we're
part
of
greater
microsoft.
Microsoft
made
this
tremendous
investment
in
github
and
also
just
you
know,
github
as
a
security
business
as
well
you're
talking,
we
just
kind
of
share
some
information
about
being
able
to
kind
of
feed
data
into
kind
of
external
other
sorts
of
tools.
You
know
just
based
on
your
experience.
You
know
coming
from
microsoft
or
having
experience
with
microsoft
yep.
A
B
Yeah,
I
think
security
center
in
azure
is,
is
a
very
natural
place
where,
where
security
center
is
really
the
hub
of
security,
it's
your
single
pane
of
glass
for
security,
for
your
entire
azure
estate,
and
so
we're
we're
working
on
integrating
into
that.
So
again,
as
these
alerts
come
up,
you
want
them
to
be
in
github
for
the
developers
where
the
developers
are
working,
but
you
may
want
to
consolidate
those
and
at
least
have
visibility
to
them
in
in
security
center
in
azure,
and
so
that
that
will
bring
this
app.
B
The
application
security,
even
though
it's
very
focused
on
the
developer
here,
will
surface
some
of
those
metrics
and
some
of
the
some
of
the
insights
into
security
center.
So
the
security
center
for
azure
at
least
becomes
this
single
pane
of
glass
across
all
of
your
azure
state,
plus
your
appsec
as
well
and
again,
other
cloud
providers
could
very
easily
integrate
into
their
security
security
center
equivalents.
Right
because
again
we
we
have
the
apis
the
web
hooks.
We
have
all
of
the
the
extensibility
points,
so
any
cloud
provider
could
could
do
that
as
well.
A
Great
another
question
that
was
brought
up
was
you:
how
are
some
of
these
capabilities
accessed
right?
Because
I
mean
immediately,
you
think,
hey
you
know
is
this
only
available?
It
can
get
an
enterprise
cloud
or
is
it
available
in
other
places,
and
obviously
I
bring
that
up,
because
you
know
we
we're
committed
to
providing.
You
know
developers
with
the
best
possible
experience
the
best
possible
capabilities,
but
is
it
just
available
there?
Can
you
get
it
in
other
sorts
of
tools
that
we
offer
solutions.
B
Yeah
great
question
so
for
for
forever,
we've
only
had
one
license
really
and
that's
and
that's
the
github
enterprise
license
right
other
than
sort
of
the
the
team's
sku
or
the
free
or
free
repos.
But
when
you
get
into
the
enterprise
space
we
would
just
sell
a
license.
A
github
enterprise
license
now
that
enterprise
license
is
assigned
to
a
user
and
that
allows
you
to
access
either
github
enterprise
cloud,
which
is
our
sas
solution,
as
well
as
github
enterprise
server.
B
So
if
you're
running
running
our
server
virtual
appliance
inside
of
your
data
center,
then
that
license
covers
you
for
either
or
or
both
platforms.
You
can
actually
hook
up
a
server
and
a
cloud
instance
now
through
through
github
connect.
So
so
that's
for
a
long
time,
that's
really
been
the
only
sku
we've
had
github
advanced
security
is
an
additional
sku
that
you
would
purchase
over
and
above
the
github
enterprise
license.
But
again
it
is
available
for
github
enterprise
cloud
as
well
as
github
enterprise
server.
B
You
have
to
be
on
one
of
the
more
recent
versions
of
github
enterprise
servers,
so
you
will
have
to
get
up
to
up
to
date.
I
think
I
think
we
started
on
three
zero,
three
one.
I
don't
one
of
the
one
of
the
three
series
for
github
enterprise
server,
where
we
supported
dependerbot
and
codeql
and
actions.
These
are
all
things
that
are
supported
now
in
github
enterprise
server,
but
to
to
enable
to
enable
secret
scanning
dependency,
review
and
code
ql.
You
will
need
additional
getup,
advanced
security
guidelines.
A
B
Yeah
and
again,
I
think
I
think
that
integration
into
that
workflow
into
the
pull
request
is
is
is
really
that
first
step,
you
know
I
I,
like
I
wrote
a
blog
post
about
about
code,
quality
versus
code
security
and
again
having
been
a
developer
and
used
some
code
quality
tools.
You
often
say
well,
you
know
what
I
know.
B
I
have
some
code
quality
issues,
but
I'm
willing
to
to
to
deploy,
even
though
I
have
that
it's
sort
of
a
risk
that
I'm
willing
to
take,
and
I
think
it's
the
same
process
here,
I
think
it's
a
little
bit
a
little
bit
more
critical
that
you
that
you
sort
out
your
secure
code.
You
you
want
to
secure
code,
is
quality
code
I'll
put
it
that
way,
as
that
contrast,
but
again
it's
around
risk
mitigation,
and
so
the
first
step
is
really
having
visibility.
Do
we
have
vulnerabilities
with
most
teams
that
are
deploying
code?
B
The
first
thing
they
don't
know
is
they
don't
know
what
vulnerabilities
they
have
and
so
using
our
tooling?
We
can.
We
can
at
least
make
you
aware
so
that
you're
that
you
know
what
is
the
risk
for
this
application
and
then
from
there
we,
the
teams
can
then
make
those
cultural
shifts
to
then
bring
stricter
and
stricter
controls
in
again,
because
it's
because
it's
integrated
in
a
platform,
it's
not
something
developers
are
going
to
hate
because
it's
really
built
into
their
workflow.
It's
not
it's
not
context.
Switching,
it's
not
oh
well.
B
I
did
the
scan
two
weeks
ago
and
then
it
took
two
weeks
to
get
the
scan
results,
and
now
I've
already
done
two
weeks
of
development.
It's
really
baked
into
that
developer
flow
right
in
the
moment,
and
so
I
think
this
is
going
to
make
it
a
lot
more,
a
lot
less
disjointed
for
developers
and
that's
going
to
be
good
for
security
of
our
applications
in
general.
A
A
So
obviously
you
had
is
that
there's
that
security
kind
of
section
there
that
that
tab,
but
you
know
we
talk
about
how
security
information
is
presented
in
a
way
that
makes
sense
to
developers
like
what
else,
what
else
can
they
do
or
how
else
can
they
interact?
With
this
information,
I
mean,
within
the
context
of
things
like
issues
yep.
B
I
can,
if
I
have
permissions
to
or
if
I
have
a
security
administrator
role,
which
is
actually
a
separate
role
that
we
allow
you
to
define
on
your
in
your
organizations.
I
can
have
this
dismiss
reason
again.
If
I
dismiss
this
as
a
false
positive.
It
comes
in
the
audit
log
and
there's
web
hooks
and
so
on.
So
we
can
build
process
around
how
these
alerts
are
dismissed,
but
this
might
might
require
a
little
bit
more
work
than
just
I'm
going
to
dismiss
this
or
I'm
going
to
fix
it
today.
B
So
we
can
track
and
again
there's
this
link
through
from
this
issue
to
the
actual
vulnerability
alert
itself
and-
and
so
this
is
the
point
where
we
would
encourage
or
where
we,
where
we're,
encouraging
teams
to
use
all
of
the
collaboration
tools
and
and
all
of
the
discussion
capabilities
here
to
work
through
these
issues,
and
so
again,
it's
not
just
a
security
professional
somewhere
who's
got
this
alert,
but
we're
allowing
the
team
to
iterate
over.
How
do
we
fix
this?
What
do
we
need
to
change?
Is
this
a
good
approach?
A
B
See
a
couple
questions,
so
I've
got
a
question
here
for
how
does
the
pandabot
work
with
and
builds
without
files
like
pom.xml,
so
what
I
showed
you
maven
build,
which
has
a
palm
xml
file
for
dependebot
today
we
only
support
a
handful
of
package
management
tools
like
like
package.json
for
npm
maven
with
a
pomxml
file.
We
are
about
to
put
into
public
public
beta,
something
we
call
dependency
api,
and
this
will
allow
tools
any
tools,
a
tool
like
gradle,
which
is
sort
of
dynamic.
B
It
doesn't
have
just
a
single
manifest
file,
it's
very
difficult
to
just
look
at
the
gradle
files
and
figure
out
what
the
dependencies
are.
You
actually
have
to
do
a
build
through
gradle
and
so
that
the
dependency
graph
is
is
is
generated
dynamically,
but
the
the
the
feature
we're
bringing
out
allows
any
tool
to
create
that
dependency
graph
for
whatever
package
management
system
you
have.
B
So
if
you
have
and
and
you're
pulling
in
pulling
in
dependencies
that
way,
you
would
we
would
be
looking
at
the
community
or
at
the
at
the
at
the
third
party,
like
ant
or
whoever's,
maintaining
those
tools
to
to
generate
that
dependency
graph
and
then
we'll
do
the
comparison
against
the
vulnerability
database.
So
today
we
support
just
really
package
manifest
package,
manifest
files
for
the
dependent
bot,
but
we're
working
on
making
that
more
dynamic
for
transient
dependencies
and
for
situations
like
great
work.
A
B
Did
very
briefly
so
I'll
go
back
over
to
code,
security
and
analysis
on
this
repository
and
over
here
when
you
enable
secret
scanning.
This
enables
all
of
the
secret
scanning
patterns
that
we
have
from
our
partners.
So
aws
google
hashi
mailchimp
all
of
these
kind
of
sas
tools
that
that
that
create
tokens,
but
I
can
also
create
custom
patterns.
A
B
So,
in
that
case
we
will
create
the
vulnerability
alert
so
that
you're
aware
that
there
is
a
vulnerability.
In
that
case,
the
pandabot
can't
create
the
pr
right,
because
there
is
no
patched
version
published,
and
so
you
still
get
the
alert.
You
may
not
get
the
pull
request
if
there
is
no
published
patched
version.
A
A
B
B
Of
course,
if,
if
one
of
your
security
admins
is
is
granted
right
permissions
through
our
sort
of
normal
roles,
then
then
they
will
have
right
permission,
but
security
admin
was
a
role
we
specifically
created
for
enterprises
where
they
said
well,
we
have
these
security
professionals
that
are
going
to
manage
the
alerts,
but
we
don't
want
them
to
have
right
access,
and
so
that's
really
the
idea
of
that.
So
colin.